CISSP Identity and Access Management 4 — Questions and Answers
Question 1: Which type of token used in OAuth 2.0 / OIDC contains encoded claims about the user and can be validated without contacting the authorization server?
- Refresh token
- Opaque token
- JSON Web Token (JWT) (Correct answer)
- SAML assertion
Correct answer: JSON Web Token (JWT)
JWTs are self-contained tokens that embed claims as a signed JSON payload, allowing resource servers to validate them locally without a round-trip to the authorization server.
Question 2: A CISSP candidate reviews a system where subjects access objects based on their security clearance and object classification labels. Which model is in use?
- Biba
- Bell-LaPadula (Correct answer)
- Clark-Wilson
- Brewer-Nash
Correct answer: Bell-LaPadula
The Bell-LaPadula model enforces confidentiality by requiring that subjects only read at or below their clearance level (no read-up) and write at or above their clearance level (no write-down).
Question 3: Which protocol extends RADIUS capabilities to support mobile and distributed network authentication with better reliability and security?
- TACACS+
- DIAMETER (Correct answer)
- LDAP
- Kerberos
Correct answer: DIAMETER
DIAMETER is the successor to RADIUS, offering improved reliability (TCP/SCTP), better error handling, and enhanced security features for AAA services.
Question 4: An attacker compromises a low-privilege account and uses it to request a service ticket for a high-privilege account, then cracks the ticket offline. What attack is this?
- Pass-the-ticket
- Golden ticket attack
- Kerberoasting (Correct answer)
- Silver ticket attack
Correct answer: Kerberoasting
Kerberoasting exploits Kerberos by requesting service tickets for accounts with SPNs and cracking them offline to recover plaintext passwords.
Question 5: Which access provisioning approach reduces risk by granting users only the minimum permissions required for their specific job responsibilities?
- Need-to-know
- Least privilege (Correct answer)
- Separation of duties
- Zero trust
Correct answer: Least privilege
The principle of least privilege restricts user access rights to only what is necessary to perform their job, reducing the attack surface if the account is compromised.
Question 6: Which identity management concept allows organizations to manage access across multiple domains without requiring shared infrastructure?
- Single sign-on
- Federated identity management (Correct answer)
- Centralized IAM
- Identity synchronization
Correct answer: Federated identity management
Federated identity management enables trust relationships between separate organizations' identity systems, allowing users to access resources across domains using their home-organization credentials.
Question 7: Which authentication method requires the user to prove identity using something they have (token) and something they know (PIN), but NOT a biometric factor?
- Three-factor authentication
- Two-factor authentication (Correct answer)
- Multi-factor biometric
- Risk-based authentication
Correct answer: Two-factor authentication
Two-factor authentication (2FA) combines exactly two distinct authentication factors; a hardware token plus a PIN uses 'something you have' and 'something you know'.
CISSP Identity and Access Management 4
Which type of token used in OAuth 2.0 / OIDC contains encoded claims about the user and can be validated without contacting the authorization server?